Usable Security and Privacy

Module overview

A system is as secure as its weakest link. When we neglect how humans use the system and fail to design the system for them, we are actively setting humans up to be the weakest link of the system. This module aims to approach security and privacy issues through a human-centric approach, bringing knowledge from computer systems, psychology, human-computer interactions (HCI), ethics, and public policies. The module will cover core security and privacy technologies, as well as HCI techniques for conducting robust user studies. Topics will include usable authentication and access control, anonymity tools, privacy notices, security warnings, and usable security and privacy issues in various domains, such as social media, web, mobile computing, IoT, and ML/AI.

Aims and Objectives

Learning Outcomes

Knowledge and Understanding

Having successfully completed this module, you will be able to demonstrate knowledge and understanding of:

Common types of human errors and their causes from a computer system perspective
Classic topics and recent advances in usable security and privacy
Methods that identify and assess potential security/privacy challenges and pitfalls that users may face in practice
Ethics around human-subject research

Subject Specific Intellectual and Research Skills

Having successfully completed this module you will be able to:

Identify and assess potential human errors, concerns, and misconceptions within an existing computer system and their impact on the given system’s security and privacy
Conduct qualitative and quantitative analysis
Critically examine academic literature in usable security and privacy
Investigate users’ perceptions and expectations of a given security and privacy tools
Identify and understand users’ needs for security and privacy tools

Subject Specific Practical Skills

Having successfully completed this module you will be able to:

Develop robust user studies in the context of system security and privacy
Clearly and accurately communicate security and privacy practices to non-technical users
Improve security and privacy driven by user inputs

Learning and Teaching

Teaching and learning methods

Lectures will be given to introduce each concept. Wider reading from the literature will be introduced alongside the lectures to consolidate and deepen the understanding of the material. Lab-based tutorials will also be provided to guide students for the practical aspects of the module.

Study time
Type	Hours
Tutorial	6
Revision	10
Lecture	30
Preparation for scheduled sessions	12
Assessment tasks	56
Wider reading or practice	36
Total study time	150

Assessment

Summative

This is how we’ll formally assess what you have learned in this module.

Breakdown
Method	Percentage contribution
Practical assignment and write-up	40%
Invigilated examination	40%
Problem sets	20%